CheckFirst

Automatic deploy

Supported by Filigran

FIMI & Disinformation

Overview

CheckFirst connector imports FIMI and disinformation campaign articles into OpenCTI, mapping influence operation infrastructure, channels, and media content as STIX 2.1 objects.

CheckFirst is a platform tracking Foreign Information Manipulation and Interference (FIMI) campaigns. This connector ingests CheckFirst articles from the CheckFirst API into OpenCTI as STIX 2.1 bundles, tracking influence operations such as the Portal-Kombat / Pravda Network Russian information campaign.

Key features:

Initial infrastructure bundle with known Pravda network domains, subdomains, and hosting IPs
Per-article ingestion mapped to STIX 2.1 objects (Intrusion Sets, Campaigns, Infrastructure, Channels, Media Content)
Deterministic STIX IDs ensuring no duplicates on reruns
Page-based progress tracking for resumable imports